Shutting down a software company: customer data first, then the company’s own
A software company that closes holds two layers. The customer layer is data it processes for others, and its contracts say what happens to it when the service ends. The company layer is its own: code history, issue tracker, design discussions, support tickets written by staff and the internal chat. The company layer is the one that can have value, and the customer layer decides how clean it has to be.
Rules to read first
There is no single federal retention rule for software companies. Contracts and the privacy law that applies to the customer’s data set the duties. Read Article 28 of the GDPR if any customer is in Europe.
| Source | What it asks of a closing company |
|---|---|
| Customer terms of service | Most say what happens on termination: return or deletion of customer data within a stated period. Read them before you cancel hosting. |
| GDPR Article 28(3)(g) | A processor, at the choice of the controller, deletes or returns all personal data after the end of the services and deletes existing copies unless the law requires storage. |
| Open source licenses | Code that includes licensed components keeps the license duties. A copyleft component can affect what the company may license or sell. |
What the company layer holds
Review comments and incident write-ups are the strongest items, because they show a problem, a diagnosis and a fix. Code alone shows only the fix.
- Repository history: commits, pull requests, review comments and the reasons given for a change.
- The issue tracker, including bug reports, triage notes and how severity was decided.
- Design documents and architecture decision records.
- Internal chat about incidents and how they were resolved.
- Support tickets as the staff wrote them, with customer detail removed.
The order that protects the value
Keep the repository host account alive until the history is exported with its pull request discussions, since a plain clone leaves the review comments behind. Then export the issue tracker and the chat. Then deal with customer data: return or delete it as the contracts require, and record the deletion in writing.
Customer data is the risk to the company layer. A support ticket may contain a customer’s data in an attachment or a pasted log, and a repository may hold test data copied from production. Scanning for those comes before any license.
What stays out
| Record | Why it stays out |
|---|---|
| Customer production data | It is processed for the customer under contract. |
| Secrets and keys in history | They must be rotated and removed, not licensed. |
| Third-party code with restrictive licenses | The company cannot grant rights it does not hold. |
| Personal data of users | It needs a legal basis and de-identification. |
Read next
- Closing or bankrupt companies. Who signs and what to keep.
- Records to keep before you close. A checker by industry.
- Liability. Who answers for what in a deal.
- Software companies while open. What a running company can license.
Questions about shutting down a software company: customer data first, then the company’s own
Do we delete customer data when we shut down?
Follow the contract. Most terms say return or delete within a stated period, and deletion is recorded in writing.
Is a git clone enough?
No. A clone has the commits. The pull request reviews and issue discussions live in the host’s database and need their own export.
Can the code itself be licensed?
It can be if the company owns it, its open source duties are met and no secrets remain in the history. A scan before licensing finds all three.
Didn't find your question? Ask us directly.